January 2006 - Xymon - Xymon mailman web

Ways you can help - Hobbit advocacy - some future plans
by michael.nemeth＠lmco.com 19 Jan '06

19 Jan '06

First incoming from the mailing list are being blocked so I have to read the archive! I hope I can still send! >- I want to be able to trigger status-changes (and hence alerts) from the data that only goes into the graphs, currently. E.g. instead of >the CPU alert triggering if the load average goes above 5 (which is pretty meaningless nowadays), I'd like it to trigger a warning if the >%system time exceeds 20, or the %idle goes below 10. Or a "conn" alert if pingtime exceeds 250 ms. (I have a pretty solid idea about >how this can be implemented - and it's elegant enough that it would also work for data from custom graphs). Aslo how about per-centage change , that cpu changed by 50% o disk change by 20 % either for up or down or both way . See http://www.i-pi.com/watcher.html might be a good time to do this too. -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ | _p_ Mike Nemeth | ___| |_____ email(w) michael.nemeth at lmco.com Work: 856 359-1425 |><___________) | Home Page:http://www.geocities.com/mjnemeth/ | Work Page:http://faraday.motown.lmco.com:3000/~nemethm/ | Work Page:http://ortsweb/~mnemeth/ |++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

[hobbit] Some newbie help
by adam.scheblein＠marquette.edu 19 Jan '06

19 Jan '06

This is not possible all the time however (and when I was talking about wheel before I meant on the server only) On the client side, on some of our boxes, in order to get swap information or some other information from TOP we need to run it as sudo, in which case then I have put the following into the sudoers file on the client servers ;) hobbit ALL = /usr/local/bin/top, /usr/sbin/swapinfo,\ /usr/users/hobbit/client/bin/hpux-meminfo Adam -----Original Message----- From: Rob Munsch [mailto:rmunsch at solutionsforprogress.com] Sent: Thursday, January 19, 2006 12:20 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Some newbie help I have to really, really, really, strongly disagree with this in heavily emphasized bold type. With a monitor running on every important machine, one of the things I like is that only the hobbit user can run hobbit, and the hobbit user can't do anything else - including sudo. It's important not to let 'little holes' like this pile up. The pile gets large rapidly. I could go on at length about specifics but i'll leave that to your local security list. No one except no one should be in sudoers except those that consistently need root privs and use them responsibly. Preferably trusted humans! lars ebeling wrote: > You should add user hobbit to sudoers. > > Lars > > ----- Original Message ----- > *From:* David Gilmore <mailto:david at stenhouseconsulting.com> > *To:* hobbit at hswn.dk <mailto:hobbit at hswn.dk> > *Sent:* Wednesday, January 18, 2006 7:29 PM > *Subject:* [hobbit] Some newbie help > > Can anyone help out a Linux newb with this error? > > Execution of '/usr/local/sbin/fping -Ae' failed - program not suid > root? > > I am migrating our monitoring from BB installed on Windows to > Hobbit on Linux. I was able to successfully install FC4, all of > the Hobbit subcomponents, and Hobbit. Just this one error has me > stumped. I thought I corrected it by adding hobbit to the WHEEL > group on FC and then editing sudoers file to uncomment WHEEL, but > I still have the error. > > David Gilmore > Consultant > Stenhouse Consulting, LLC. > 4 Traverse St > Providence, RI 02906 > 401.453.6900 > 401.454.7581 (fax) > > To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

2 1

Some newbie help
by david＠stenhouseconsulting.com 19 Jan '06

19 Jan '06

Can anyone help out a Linux newb with this error? Execution of '/usr/local/sbin/fping -Ae' failed - program not suid root? I am migrating our monitoring from BB installed on Windows to Hobbit on Linux. I was able to successfully install FC4, all of the Hobbit subcomponents, and Hobbit. Just this one error has me stumped. I thought I corrected it by adding hobbit to the WHEEL group on FC and then editing sudoers file to uncomment WHEEL, but I still have the error. David Gilmore Consultant Stenhouse Consulting, LLC. 4 Traverse St Providence, RI 02906 401.453.6900 401.454.7581 (fax)

3 2

Client log parsing (suggestion)
by rgordonjr＠gmail.com 19 Jan '06

19 Jan '06

Hi Henrick - In one of the previous messages, you had mentioned that you wanted to keep as much configuration data on the server as possible in order to make adminstration easier. To that end I offer the following suggestion for the message configuration.. In the bb man page (4.1.2 early snapshot) there is a section that reads as follows: >>>>>>>>>>>>>> config FILENAME Retrieve one of the Hobbit configuration files from the server. This command allows a client to pull files from the $BBHOME/etc/ directory on the server, allowing for semi-automatic updates of the client configuration. Since the configuration files are designed to have a common file for the configuration of all hosts in the system - and this is in fact the recommended way of configuring your clients - this makes it easier to keep the configuration files synchronized. >>>>>>>>>>>>>> Why not set things up as follows: 1 - On the server have a "hobbit-msg" file that contains default configuration information that applies to all systems. (I.E. Alert on kernel warning and panic messages from the syslog). 2 - In the same directory (or a subdirectory) have seperate hobbit-msg.<servername> files that contain specific configuration information for the specified hosts. 3 - Once an hour (or other configurable time frame) have the client systems issue a command to pull the default file as well as the system specific file from the server. If the client specific file is not available use the default file, otherwise use the standard configuration.. Doing it this way would still allow for central administration of the configuration files as well as allow for custom message parsing configurations on the target systems.. Anyways.. Just a thought.. Later - -- --==[ Bob Gordon ]==--

1 0

INTERVAL in clientlaunch.cfg
by jeffnewman75＠gmail.com 19 Jan '06

19 Jan '06

Hi, Question about the INTERVAL setting in clientlaunch.cfg: Per the man page (for hobbitlaunch.cfg) The *INTERVAL* keyword defines how often this command is executed. {...} Intervals can be specified in seconds (if you just put a number there), or in minutes (5m), hours (2h), or days (1d). So I was trying to get netstat -s working every second. This should be possible with the client script: #!/bin/sh netstat -s > /tmp/hiflow_net.txt $BB $BBDISP "status $MACHINE.HiFlowNet green `date` `cat /tmp/hiflow_net.txt` " exit 0 Measuring the time it takes for this to complete: # time hiflow_net real 0m0.04s user 0m0.00s sys 0m0.01s Running every second is workable. Following the man page, I did the following with my clientlaunch.cfg: [client] ENVFILE $HOBBITCLIENTHOME/etc/hobbitclient.cfg CMD $HOBBITCLIENTHOME/bin/hobbitclient.sh LOGFILE $HOBBITCLIENTHOME/logs/hobbitclient.log INTERVAL 5m [hiflow_net] ENVFILE /usr/local/hobbit/client/etc/hobbitclient.cfg CMD /usr/local/hobbit/client/ext/hiflow_net LOGFILE=/tmp/hilog INTERVAL 1 The data does arrive at the hobbit server, however, not every second. I get a weird behavior from hobbit. I did a: while true; do ps -ef | grep netstat | grep -v grep done And this is what I see: hobbit 70112 24322 0 23:30:53 - 0:00 [netstat] hobbit 57350 15788 1 23:31:03 - 0:00 netstat -s hobbit 28558 63650 0 23:31:08 - 0:00 [netstat] hobbit 14486 23038 0 23:31:18 - 0:00 [netstat] hobbit 16646 60686 0 23:31:33 - 0:00 netstat -s hobbit 28568 64464 0 23:31:43 - 0:00 [netstat] hobbit 20928 63544 1 23:31:53 - 0:00 netstat -s hobbit 53638 58900 0 23:31:58 - 0:00 [netstat] hobbit 64280 14410 0 23:32:03 - 0:00 netstat -s Any thoughts (Besides the running debate on the need for 1 second vs 5 minute periods)? -Jeff

2 2

conn alerts based on ping time
by jonescr＠cisco.com 19 Jan '06

19 Jan '06

I'm helping someone set up Hobbit at their company, and they want to monitor the status of a remote office T1 link. Of course Hobbit can tell them if the link goes totally down, or you can ignore bad pings with "badconn", but they want to know when the link is *slow*, as they often have periods of time when the pings are not dropped, but instead taking 1-3 seconds (instead of <100ms like normal). Is there any chance that Hobbit will soon support comparing the ping replies to specifiied values for green, yellow, and red? Somethign like: 1.2.3.4 myhost.com # conn:200:500 This would make myhost.com's conn test go yellow if the ping was between 200 and 500ms, and red if it was over 500ms. Since hobbit already graphs the numeric values of the ping replies, this seems like it would be fairly easy to add? -Charles

3 3

[hobbit] Help with Graphing peak values
by Phil.Wild＠asgardwealthsolutions.com.au 19 Jan '06

19 Jan '06

Many thanks with this answer. I'll give it a go and report back. Phil -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Thursday, 19 January 2006 1:49 AM To: hobbit at hswn.dk Subject: Re: [hobbit] Help with Graphing peak values > Typically, our systems are very busy during the day yet at night are > mostly idle (load average of around 10 to 12. When you look at the > graphs produced from a capacity planning perspective, for the last 48 > hours, you get accurate values, but from a 576 day graph, the load average is much lower as it is taking into account the out of hours period. That's how rrdtool works - the further back in time you go, the more the data is averaged out over the entire time period. > I was thinking it would be nice to see a line plotted on the same > graph showing the peak value for the sample rather than the average. You *can* do it, but it will require that you create custom RRD's for the data that you want to measure like this. RRDtool stores data from one dataset in one or more "archives" called "RRA's". An RRA uses a "consolidation function" to convert the raw data into the data that it stores - typically by computing an average value over the time interval that is used for the data. But you need not use the "average" method - there are others, including MIN and MAX to store the minimum and maximum values for a timeperiod. When Hobbit creates a new RRD file, it defines 4 archives for each dataset. All of them use the AVERAGE function, but averages the data over different time periods, which is why there are 4 graphs for each data showing the 48-hour, one-week, 4 weeks, and 576 days data. So what you can do is to create the RRD files by hand using the "rrdtool create" command. As long as the dataset names match, Hobbit will happily update your custom RRD files - rrdtool takes care of that. So for e.g. the cpu load (the "la.rrd" file): "rrdtool dump" tells you that there is one dataset called "la" of type GAUGE and a minimum value of 0. So you could create such an rrd file with the command rrdtool create la.rrd \ DS:la:GAUGE:600:0:U \ RRA:AVERAGE:0.5:1:576 \ RRA:AVERAGE:0.5:6:576 \ RRA:AVERAGE:0.5:24:576 \ RRA:AVERAGE:0.5:288:576 \ RRA:MAX:0.5:288:576 The first 4 RRA's are the standard ones Hobbit uses. The last one is a custom RRA that stores the maximum reading over 288 measurements (that's 24 hours since we measure once every 5 minutes), and keeps 576 of those measurements in the database. So it gives you the max. load seen over the past 576 days. If you create such a file in the ~hobbit/data/rrd/HOSTNAME/ directory where Hobbit puts its RRD files, it should be updated automatically. Then to graph the data, you just have to setup a custom graph definition that uses the MAX RRA instead of the AVERAGE one: [maxla] TITLE MAX CPU Load YAXIS Load DEF:avg=la.rrd:la:MAX CDEF:la=avg,100,/ AREA:la#00CC00:CPU Load Average -u 1.0 Compare it to the existing [la] definition in hobbitgraph.cfg, and you'll see they are almost identical. I haven't tried this at all, so if you do - please let us know what your experiences are. Regards, Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk ======================================================= IMPORTANT INFORMATION This message and any files transmitted with it are confidential and should be read only by those persons to whom it is addressed. If you have received this message in error, please notify us immediately by way of reply. Please also destroy and delete the message from your computer. Any unauthorised form of reproduction of this message is strictly prohibited. It is the duty of the recipient to virus scan and otherwise test the information provided before loading on to any computer system. No warranty is given or made by Asgard Wealth Solutions Limited, Asgard Capital Management Limited or SECURITOR Financial Group Limited that the information is free of a virus or any other defect or error and they will not be liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt. Any views expressed in this message are those of the individual sender, except where the sender specifically states they are the views of Asgard Wealth Solutions Limited, Asgard Capital Management Limited or SECURITOR Financial Group Limited, as the case may be. =======================================================

1 0

[hobbit] Some newbie help
by adam.scheblein＠marquette.edu 18 Jan '06

18 Jan '06

Otherwise, check your sudoers file and see if wheel is the following %wheel ALL=(ALL) NOPASSWD: ALL If it is, then when you setup hobbit server (doing the ./configure -server) when it asks about the command for fping, put in sudo fping instead. Adam ________________________________ From: Smith, Jim [mailto:JMSmith at stvincenthealth.com] Sent: Wednesday, January 18, 2006 12:36 PM To: hobbit at hswn.dk Subject: RE: [hobbit] Some newbie help As root, you need to change the owner of "fping" to root and the permissions to 4755. ________________________________ From: David Gilmore [mailto:david at stenhouseconsulting.com] Sent: Wednesday, January 18, 2006 12:29 PM To: hobbit at hswn.dk Subject: [hobbit] Some newbie help Can anyone help out a Linux newb with this error? Execution of '/usr/local/sbin/fping -Ae' failed - program not suid root? I am migrating our monitoring from BB installed on Windows to Hobbit on Linux. I was able to successfully install FC4, all of the Hobbit subcomponents, and Hobbit. Just this one error has me stumped. I thought I corrected it by adding hobbit to the WHEEL group on FC and then editing sudoers file to uncomment WHEEL, but I still have the error. David Gilmore Consultant Stenhouse Consulting, LLC. 4 Traverse St Providence, RI 02906 401.453.6900 401.454.7581 (fax) NOTICE: This email contains confidential or proprietary information which may be legally privileged. It is intended only for the named recipient(s). If an addressing error has misdirected the email, please notify the author by replying to this message. If you are not the named recipient, you are not authorized to use, disclose, distribute, copy, print or rely on this email, and should immediately delete it from your computer system.

3 3

[hobbit] conn alerts based on ping time
by rdeal＠tigr.ORG 18 Jan '06

18 Jan '06

Sounds like they need to through in MRTG and go red when the traffic is high on the link. And then throw in things like bb-ospf.pl to check that ospf is not flapping over the link bb-xsnmp.pl to check out the routers at each end and the interfaces you can also use http to a reliable server on the remote side as part of the link test. Just make the http test for the link dependent on the router and the conn test to the web server. ________________________________ From: Charles Jones [mailto:jonescr at cisco.com] Sent: Friday, January 13, 2006 1:01 PM To: hobbit at hswn.dk Cc: crimson at technologist.com Subject: [hobbit] conn alerts based on ping time I'm helping someone set up Hobbit at their company, and they want to monitor the status of a remote office T1 link. Of course Hobbit can tell them if the link goes totally down, or you can ignore bad pings with "badconn", but they want to know when the link is slow, as they often have periods of time when the pings are not dropped, but instead taking 1-3 seconds (instead of <100ms like normal). Is there any chance that Hobbit will soon support comparing the ping replies to specifiied values for green, yellow, and red? Somethign like: 1.2.3.4 myhost.com # conn:200:500 This would make myhost.com's conn test go yellow if the ping was between 200 and 500ms, and red if it was over 500ms. Since hobbit already graphs the numeric values of the ping replies, this seems like it would be fairly easy to add? -Charles

4 5

[hobbit] Some newbie help
by JMSmith＠stvincenthealth.com 18 Jan '06

18 Jan '06

As root, you need to change the owner of "fping" to root and the permissions to 4755. ________________________________ From: David Gilmore [mailto:david at stenhouseconsulting.com] Sent: Wednesday, January 18, 2006 12:29 PM To: hobbit at hswn.dk Subject: [hobbit] Some newbie help Can anyone help out a Linux newb with this error? Execution of '/usr/local/sbin/fping -Ae' failed - program not suid root? I am migrating our monitoring from BB installed on Windows to Hobbit on Linux. I was able to successfully install FC4, all of the Hobbit subcomponents, and Hobbit. Just this one error has me stumped. I thought I corrected it by adding hobbit to the WHEEL group on FC and then editing sudoers file to uncomment WHEEL, but I still have the error. David Gilmore Consultant Stenhouse Consulting, LLC. 4 Traverse St Providence, RI 02906 401.453.6900 401.454.7581 (fax) NOTICE: This email contains confidential or proprietary information which may be legally privileged. It is intended only for the named recipient(s). If an addressing error has misdirected the email, please notify the author by replying to this message. If you are not the named recipient, you are not authorized to use, disclose, distribute, copy, print or rely on this email, and should immediately delete it from your computer system.

1 0